binarylogic/authlogic — pull request #347 by tiegz (2013-02-21 18:53:11+00:00)
Title: Impose the Ruby library's Bcrypt min cost in Authlogic

### WHAT

* Raise an error if user tries to set Authlogic's Bcrypt `cost` to a value less than the `bcrypt-ruby` minimum cost of 4.
* Update documentation with this minimum value

### WHY

Without this change, you can set Authlogic's Bcrypt cost to < 4, but the effective cost is 4 because that is the minimum (in `bcrypt-ruby`). Notice the cost value here is still 4 when you go below 4 (`bcrypt-ruby` does this [here](/codahale/bcrypt-ruby/blob/master/lib/bcrypt.rb#L63)):

``` ruby
BCrypt::Password.create("mypass", :cost => 5)
=> "$2a$05$2V8i6PMGPTJZPU7sofnoDOkmvMjAYeratP1GtsZz.WMCfPYz0FKYm"
BCrypt::Password.create("mypass", :cost => 4)
=> "$2a$04$YkVbcWgR8UmRdV.JA/v8d.ZcD3lVaeI5qZsvufmgWqBCw7k2ITu6W"
BCrypt::Password.create("mypass", :cost => 3)
=> "$2a$04$ICFZipoQJHeUk59Ks9hiruGjXZ2rtN7yevS76uexXwD9H177QjqYe"
```

Aside from being misleading, setting this to a value such as 2 would also trigger `transition_password` every time a user enters their password (which also updates `persistence_token`). This is because the cost of the encryptor (2) doesn't match the cost of the bcrypt hash (4), so Authlogic assumes you need to transition your password. This isn't a security problem afaik, but rather an unnecessary database update.

### ALSO
I re-ran the benchmarks on my computer against a new cost of 4, which appears to be slower, but still shows the magnitude between the different costs/algorithms.